Year: 2022 - RH-ISAC Blog

After two years of being virtual due to pandemic-related precautions, RH-ISAC’s Cyber Intelligence Summit is back in person this year! We’ll be in Dallas on September 20-21 to host the premier event for cybersecurity practitioners in the retail, hospitality, and travel industries.  Here are just a few of the many reasons that our members are…

Vienna, VA (August 30, 2022) – The Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC) today announced that Splunk will be the title sponsor of the RH-ISAC Cyber Intelligence Summit which takes place September 20-21 in Dallas/Plano, TX.   This annual event is tailored for strategic leaders and cybersecurity practitioners from physical and online retailers, hotels,…

The new HYPERSCRAPE data extraction tool developed by the Iranian Charming Kitten threat group eases the process of stealing email data from targeted accounts. Context On August 23, 2022, Google Threat Analysis Group (TAG) researchers published a technical analysis of a unique data extraction tool they named “HYPERSCRAPE” used by the Iranian state-backed Charming Kitten…

Flashpoint’s 2022 Mid-Year Data Breach report shows an overall 15% decline in reported breaches from the same period last year and suggests that the retail, hospitality, and travel sectors are not among the industries reporting the most breaches by volume. Context On August 18, 2022, Flashpoint released its State of Data Breach Intelligence 2022 Midyear…

RH-ISAC’s Cyber Intelligence Summit, taking place this year in Dallas, TX, on September 20-21, is the premier event for cybersecurity practitioners in the retail, hospitality, and travel industries. The two-day conference features keynote speakers, breakout sessions for peer-to-peer learning, and plenty of opportunities for networking during nightly happy hours and dinners. This year’s agenda was…

The SEABORGIUM phishing operation targets organizations with a connection to Russian interests leveraging three different open-source phishing kits, the most prevalent of which has been observed in recently reported phishing attacks. Context On August 15, 2022, Microsoft Threat Intelligence Center (MSTIC) researchers disclosed details of a phishing and cyberespionage operation that they disrupted in partnership…

Context On August 4, 2022, Cisco Talos Intelligence researchers reported new technical details of a tool called “Dark Utilities” that provides a full suite of command-and-control (C2) capabilities for threat actors. The tool, which was released in early 2022, is advertised by creators as enabling remote access, command execution, distributed denial-of-service (DDoS) attacks, and cryptomining…

One of the unfortunate truths for trust and fraud teams is that they spend more time fighting within their organization to get access to the data they need than they do fighting bad actors. These teams often build collaborative relationships with cybersecurity teams to address issues like credential stuffing and bots, but a new generation…

Context On August 3, 2022, ZScaler researchers reported the technical details of an adversary in the middle (AiTM) campaign active since at least June 2022. The RH-ISAC team believes, based on timing and nearly identical tactics, techniques, and procedures (TTPs), that this campaign is likely connected to highly similar activity previously reported by Microsoft. Key…

Context On June 7, 2022, researchers at Zimperium reported technical details of an adware campaign targeting Russian gaming, social media, and ecommerce site users. The campaign uses more than 350 variations of malicious browser extensions using the Google Translate extension ID to trick victims into downloading the malicious files. Researchers named the extension group “ABCsoup.”…